1a1b9cb18a6fbcc0085c7cd142a9c614eb792cf3b51db37c60fa23157b4b029b

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47f8baa50df6ff2dbfd0dc0dd68ca1a_JaffaCakes118.html
Size

30KB
MD5

d47f8baa50df6ff2dbfd0dc0dd68ca1a
SHA1

ec754c2c9f3cad2df4be8c2389a5c6a5611507c0
SHA256

1a1b9cb18a6fbcc0085c7cd142a9c614eb792cf3b51db37c60fa23157b4b029b
SHA512

261b2d938fbf765317f0f750175ff38fef4093f3418193164dfdbb80425f7606352373cb0cc4999d97f0ce690baa6d7c290471184b57172fd20509b0b07ca941
SSDEEP

768:swA2k0VjIeCCeCzCKCKCQCQCgCgCq2j9wNLzKisqAQNl:s/2k0VjIeC3+jjNNnn6junKisqAQNl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
1864	msedge.exe
1864	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 5104	1864	msedge.exe	84
PID 1864 wrote to memory of 5104	1864	msedge.exe	84
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 1136	1864	msedge.exe	85
PID 1864 wrote to memory of 2924	1864	msedge.exe	86
PID 1864 wrote to memory of 2924	1864	msedge.exe	86
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87
PID 1864 wrote to memory of 1880	1864	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d47f8baa50df6ff2dbfd0dc0dd68ca1a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae52946f8,0x7ffae5294708,0x7ffae5294718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17750450416775187709,9075919790140603142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
313B

MD5
6ce0c8b262ea384e0ee0cb15bd9cf362

SHA1
8010fc88faefa262ccd6a4bad6fff9a92c7dde6a

SHA256
c54ebcc07966b001347e24a8f700517c23cd03bcd74655be3ea51435ed1bb27e

SHA512
e1222d57875cd17257d3eda10df4473f2d5657c839c0c9220da672f49364e7bff70e369e19a2afaad946acdbce60982929977c84671dc11510ab05aa7232b17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
761b7b56c60f3b0eb353940d4e7cd7fc

SHA1
a7870ebfaafb5348eddaa6ad3af1857f586f4c30

SHA256
97c3d831c7670a176a02ef3becff1bf713f16468778da043ecf3419850f0259d

SHA512
195a1b56c99b189042c06b9b8b6ee04f77e28a4ebfb1db4353d464fa4f4135873aec894a127ea97f8d71677fe0fdf08bc13384f28ee6a22aa7197a826cf25170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a71b5d89b892e59ecf86a72d0b9af0fb

SHA1
5c70d665d6e4c2a3281ca388fad50d101346fea3

SHA256
8e624e7e395c5eae11495f9e2c36d06f3bf4acccc9a51ae3fbc40244e224ce97

SHA512
05dd8511741b83c8decc62776ae95c629cf657374e71da3958c86142ae33f37f89c1c2d1ebeaef36a3eeb2b3a4794fb9f77fc9de042832c273f17eccf4cd75f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b7c87a55c90b7f53eb5c89391507e37

SHA1
9353dfa7efe95a82719121c796f632c1c979fca0

SHA256
68fbd5df113c7592dd6000cd9f34fbdf48b722425efac4818d0e65624458bb6d

SHA512
513194b4bcdb398e81bf83cc4703b352c6f690f08a5062be3043576092b884cdd8f4dc0fb43904fd65237af45debba57b48b03b7207059cf8252f41ee0010358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5f06df98bd78d2741fc3f5e476a9152b

SHA1
e81160707297e4e22e9b73a48efc4cc2aedfe113

SHA256
596f7c8e959210bd784a681fead98cad9a5231addd1039764ec455a943136d5b

SHA512
d2033e321ea0a1895983309e9c441543673fa2913995d441f932d11d8c200c05151eb3fd6c1b89be322d98cfd63e56b0d5b2846f086e285399fd3ac2632b0e91

Download Submit